A one-byte heap buffer overflow vulnerability exists in Node.js HTTP/2 Alt-Svc handling. This flaw allows a remote, unauthenticated attacker to corrupt process memory by sending a specially crafted request with a long :authority header. The vulnerability affects Node.js versions 24.x and 26.x and can cause the process to abort due to out-of-bounds memory writes.